--- title: 内存越界 description: "分析应用程序的内存越界，给出异越界类型和内存访问信息。" url: https://www.hikunpeng.com/document/detail/zh/kunpengdevkithistory/devkit_24_rc3/cliuserguide/KunpengDevKitCli_0078.html sourcePath: /source/zh/kunpengdevkithistory/devkit_24_rc3/cliuserguide/KunpengDevKitCli_0078.html indexId: 6b22b093c4bd94340a5f17c76f91a7abd3e3289d6437bb8ff44883a089a6971b85 --- # 内存越界 #### 命令功能 分析应用程序的内存越界，给出异越界类型和内存访问信息。 #### 命令格式 ``` devkit doctor memoob [-h] [-l {0,1,2,3}] [--package] [--ns] [-o ] workload ... ``` workload...为采集的应用，实际使用请替换为应用路径。 #### 参数说明 **表1 参数说明** | 参数 | 参数选项 | 说明 | | --- | --- | --- | | \-h/\-\-help | \- | 获取帮助信息。 | | \-l/\-\-log\-level | 0/1/2/3 | 设置日志级别，默认为2。 0：日志级别为DEBUG。 1：日志级别为INFO。 2：日志级别为WARNING。 3：日志级别为ERROR。 | | \-\-package | \- | 设置是否将数据导入数据库，并在指定输出路径中生成压缩包。 | | \-\-ns | \- | 设置应用程序异常后是否终止分析，使用此参数时程序异常后继续分析，不使用则程序异常后终止分析。如需程序异常后继续分析，请在应用程序编译时添加\-fsanitize\-recover=address选项。 | | \-o/\-\-output | \- | 设置报告数据生成文件名，默认为当前所在目录。 | #### 使用示例 ``` devkit doctor memoob -l 1 --package -o /home/overdemos /home/overdemos ``` 参数-o /home/overdemos表示在/home/目录下生成名为overdemos.tar的分析报告压缩包，命令最后的/home/overdemos为待分析应用的绝对路径。 返回信息如下： ``` [INFO]Collect start Stop Collecting while memory overwriting exception caused exit. Note: You can set "-ns" to collect all overwriting exceptions. Collection process may cost a while, please wait ... [INFO]/home/overdemods [INFO]Collect end [INFO]Analysis start Memory Overwriting Report Time:20240807-113323 ================================================================================ Program Name: /home/overdemos Overwriting-1 ──────────────────────────────────────────────────────────────────── PID 3003303 File /home/overdemo2_bak.cpp Function danglingPointerExample() Overwriting Type (heap) use after free Access Type READ Overwriting access point: ──────────────────────────────────────────────────────────────────── Idx Address Function File ──────────────────────────────────────────────────────────────────── #0 0x4017dc danglingPointerExample() /home/overdemo2_bak.cpp:24 #1 0x401bd0 main /home/overdemo2_bak.cpp:50 #2 0xffff9ec62fbc UNKNOWN (/usr/lib64/libc.so.6+0x2afbc) #3 0xffff9ec63094 __libc_start_main (/usr/lib64/libc.so.6+0x2b094) #4 0x4013ec _start (/home/overdemos+0x4013ec) ──────────────────────────────────────────────────────────────────── Auxiliary Information: freed by thread T0 here: ──────────────────────────────────────────────────────────────────── Idx Address Function File ──────────────────────────────────────────────────────────────────── #1 0x4016d8 danglingPointerExample() /home/overdemo2_bak.cpp:22 #2 0x401bd0 main /home/overdemo2_bak.cpp:50 #3 0xffff9ec62fbc UNKNOWN (/usr/lib64/libc.so.6+0x2afbc) #4 0xffff9ec63094 __libc_start_main (/usr/lib64/libc.so.6+0x2b094) #5 0x4013ec _start (/home/overdemos+0x4013ec) ──────────────────────────────────────────────────────────────────── previously allocated by thread T0 here: ──────────────────────────────────────────────────────────────────── Idx Address Function File ──────────────────────────────────────────────────────────────────── #1 0x4016cc danglingPointerExample() /home/overdemo2_bak.cpp:21 #2 0x401bd0 main /home/overdemo2_bak.cpp:50 #3 0xffff9ec62fbc UNKNOWN (/usr/lib64/libc.so.6+0x2afbc) #4 0xffff9ec63094 __libc_start_main (/usr/lib64/libc.so.6+0x2b094) #5 0x4013ec _start (/home/overdemos+0x4013ec) ──────────────────────────────────────────────────────────────────── More Information: Shadow bytes around the buggy address: 0x200ff35000a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff35000b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff35000c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff35000d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff35000e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa => 0x200ff35000f0: fa fa fa fa fa fa[fd]fa fa fa fa fa fa fa fa fa 0x200ff3500100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff3500110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff3500120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff3500130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff3500140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable 00 Partially addressable 01 02 03 04 05 06 07 Heap left redzone fa Freed heap region fd Stack left redzone f1 Stack mid redzone f2 Stack right redzone f3 Stack after return f5 Stack use after scope f8 Global redzone f9 Global init order f6 Poisoned by user f7 Container overflow fc Array cookie ac Intra object redzone bb ASan internal fe Left alloca redzone ca Right alloca redzone cb Shadow gap cc ==3003303==ABORTING Overwriting-2 ──────────────────────────────────────────────────────────────────── PID 3003304 File /home/overdemo2_bak.cpp Function outOfBoundsWithVector() Overwriting Type heap buffer overflow Access Type WRITE Overwriting access point: ──────────────────────────────────────────────────────────────────── Idx Address Function File ──────────────────────────────────────────────────────────────────── #0 0x401ad8 outOfBoundsWithVector() /home/overdemo2_bak.cpp:31 #1 0x401bb8 main /home/overdemo2_bak.cpp:52 #2 0xffff9ec62fbc UNKNOWN (/usr/lib64/libc.so.6+0x2afbc) #3 0xffff9ec63094 __libc_start_main (/usr/lib64/libc.so.6+0x2b094) #4 0x4013ec _start (/home/overdemos+0x4013ec) ──────────────────────────────────────────────────────────────────── Auxiliary Information: allocated by thread T0 here: ──────────────────────────────────────────────────────────────────── Idx Address Function File ──────────────────────────────────────────────────────────────────── #1 0x401930 outOfBoundsWithVector() /usr/include/c++/10.***new_allocator.h:115 #2 0x401bb8 main /home/overdemo2_bak.cpp:52 #3 0xffff9ec62fbc UNKNOWN (/usr/lib64/libc.so.6+0x2afbc) #4 0xffff9ec63094 __libc_start_main (/usr/lib64/libc.so.6+0x2b094) #5 0x4013ec _start (/home/overdemos+0x4013ec) ──────────────────────────────────────────────────────────────────── More Information: Shadow bytes around the buggy address: 0x200ff3640110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff3640120: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff3640130: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff3640140: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff3640150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa => 0x200ff3640160: fa fa fa fa fa fa fa fa fa fa 00 00[04]fa fa fa 0x200ff3640170: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff3640180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff3640190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff36401a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x200ff36401b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable 00 Partially addressable 01 02 03 04 05 06 07 Heap left redzone fa Freed heap region fd Stack left redzone f1 Stack mid redzone f2 Stack right redzone f3 Stack after return f5 Stack use after scope f8 Global redzone f9 Global init order f6 Poisoned by user f7 Container overflow fc Array cookie ac Intra object redzone bb ASan internal fe Left alloca redzone ca Right alloca redzone cb Shadow gap cc ==3003304==ABORTING Overwriting-3 ──────────────────────────────────────────────────────────────────── PID 3003301 File /home/overdemo2_bak.cpp Function arrayOutOfBoundsExample() Overwriting Type stack buffer overflow Access Type WRITE Overwriting access point: ───────────────────────────────────────────────────────────────────── Idx Address Function File ──────────────────────────────────────────────────────────────────── #0 0x40167c arrayOutOfBoundsExample() /home/overdemo2_bak.cpp:16 #1 0x401bc8 main /home/overdemo2_bak.cpp:48 #2 0xffff9ec62fbc UNKNOWN (/usr/lib64/libc.so.6+0x2afbc) #3 0xffff9ec63094 __libc_start_main (/usr/lib64/libc.so.6+0x2b094) #4 0x4013ec _start (/home/overdemos+0x4013ec) ───────────────────────────────────────────────────────────────────── Auxiliary Information: ──────────────────────────────────────────────────────────────────── Idx Address Function File ──────────────────────────────────────────────────────────────────── #0 0x4014d0 arrayOutOfBoundsExample() /home/overdemo2_bak.cpp:12 ──────────────────────────────────────────────────────────────────── This frame has 1 object(s): [32, 52) 'arr' (line 13) <== Memory access at offset 52 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) More Information: Shadow bytes around the buggy address: 0x200ffc852a40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffc852a50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffc852a60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffc852a70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffc852a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 => 0x200ffc852a90: f1 f1 f1 f1 00 00[04]f3 f3 f3 f3 f3 00 00 00 00 0x200ffc852aa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffc852ab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffc852ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffc852ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x200ffc852ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable 00 Partially addressable 01 02 03 04 05 06 07 Heap left redzone fa Freed heap region fd Stack left redzone f1 Stack mid redzone f2 Stack right redzone f3 Stack after return f5 Stack use after scope f8 Global redzone f9 Global init order f6 Poisoned by user f7 Container overflow fc Array cookie ac Intra object redzone bb ASan internal fe Left alloca redzone ca Right alloca redzone cb Shadow gap cc ==3003301==ABORTING [INFO]Analysis end [INFO]Report start Packaging process may cost a while, please wait ... Export package success! The tar report is allocated in /home/overdemos.tar. [INFO]Report end [INFO]Finalize start [INFO]Finalize end ``` 报告中对异常提示的内容： ``` This frame has 1 object(s): [32, 52) 'arr' (line 13) <== Memory access at offset 52 overflows this variable HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) ``` 通过--package参数打包生成TAR包，可将TAR包导入Web界面查看图形化信息。